Fraud & Identity Management

Fraud is a serious concern for everyone, including businesses and individuals. In fact, according to our 2023 U.S. Identity and Fraud Report, nearly two-thirds (64%) of consumers are very or somewhat concerned with online security, and over 50% of businesses have a high level of concern about fraud risk. The fraud landscape is constantly evolving, and staying vigilant against the latest trends is critical to safeguarding your organization and consumers. As we reflect on 2023, let’s look at the top fraud trends and their continued potential impact on your business. The evolution of new fraud trends When economic uncertainty reigns, a rise in fraud often follows. To begin with, consumers tend to be financially stressed in such periods and prone to making risky decisions. In addition, fraudsters are keenly aware of the opportunities inherent in unstable times and develop tactics to take advantage of them. For example, as consumers rein in spending and financial institutions struggle to maintain new account volumes, fraudsters might ramp up their new account and loan activities. Fraud is becoming more sophisticated. For instance, thanks to the rapid rise in the availability of artificial intelligence (AI) tools, fraudsters are increasingly able to impersonate companies and individuals with ease, as well as consolidate data from diverse sources and use it more efficiently. The most impactful fraud trends of 2023 The fraud trends that emerged in 2023 were diverse, though they all had one thing in common: fraudsters' keen ability to take advantage of new technologies and opportunities. And businesses are feeling the repercussions, with nearly 70% reporting that fraud losses have increased in recent years. Here are five trends we forecasted in the fraud and identity space that challenged fraud fighters on the front lines this year. Deposit and checking account fraud With everyone focused on fraud in the on-line channels, it is interesting that financial institutions reported more fraud occurring at brick-and-mortar locations. Preying on the good nature of helpful branch employees, criminals are taking risks by showing up in person to open accounts, pass bad deposits and try to work their way into other financial products.  The Treasury Department reports complaints doubling YoY, after increasing more than 150% between 2020 and 2021.  Synthetic identity fraud Not quite fake, not quite real, so-called synthetic or "Frankenstein" identities mash up real data with false information to create unique customer profiles that can outsmart retailers' or financial institutions' fraud control systems. With synthetic identity (SID) fraud real data is often stolen or purchased on the dark web and combined with other information — even Artificial Intelligence (AI)-created faces — so that fraudsters can build up a synthetic identity's credit score before taking advantage of them to borrow and spend money that will never be paid back. One major risk? As fraud rates rise due to the use of tactics like synthetic identities, it could become more challenging and expensive to access credit. Fake job postings and mule schemes Well-paying remote work was in high demand this year, creating opportunities for fraudsters to create fake jobs to harvest data such as Social Security numbers from unsuspecting applicants. Experian also predicts a continued rise in "mule" jobs, in which workers unknowingly sign on to do illegal work, such as re-shipping stolen goods. According to the Better Business Bureau, an estimated 14 million people get caught in a fake employment scam yearly. Job seekers can protect themselves by being skeptical of jobs that ask them to do work that appears suspicious, requires money, financial details, or personal information upfront. Peer-to-peer payment fraud Peer-to-peer payment tools are increasingly popular with consumers and fraudsters, who appreciate that they're both instant and irreversible. Experian expects to continue to see an increase in fraudulent activity on these payment systems, as fraudsters use social engineering techniques to deceive consumers into paying for nonexistent merchandise or even sharing access credentials. Stay safe while using peer-to-peer payment tools by avoiding common scams like requests to return accidental payments, opting for payment protection whenever possible and choosing other transaction methods like paying with a credit card. Social media shopping fraud Social media platforms are eager to make in-app shopping fun and friction-free for consumers — and many brands and shoppers are keen to get on board. In fact, approximately 58% of users in the U.S. have purchased a product after seeing it on social media. Unfortunately, these tools neglect effective identity resolution and fraud prevention, leaving sellers vulnerable to fraudulent purchases. And while buyers have some recourse when a purchase turns out to be a scam, it's wise to be cautious while shopping on social media platforms by researching sellers, only using credit cards and being cognizant of common scams, like when vendors on Facebook Marketplace ask for payment upfront. Employer text fraud Fraudulent text messages — also known as “smishing,” a mash-up of Short Messaging Service (SMS) and phishing — continues to rise. In fact, according to data security company Lookout, 2022 was the biggest year ever for such mobile phishing attacks, with more than 30 percent of personal and enterprise mobile phone users exposed every quarter. One modern example of these types of schemes? Expect to continue to see a rise in gift card fraud targeting companies. For example, an employee might receive a text from their "boss" asking them to purchase gift cards and relay the numbers. The fraudsters get to shop, and the company is left with the bill. Why fraud prevention and detection solutions matter Nearly two-thirds of consumers say they are "very" or "somewhat concerned" with online security, and more than 85 percent expect businesses to respond to their identity and fraud concerns. Addressing and preventing fraud — and communicating these fraud-prevention actions to customers — is an essential strategy for businesses that want to maintain customer trust, thereby decreasing churn and maximizing conversions on new leads. There's a financial imperative to address fraud as well. Businesses stand to lose a great deal of money without adequate fraud prevention strategies. Account takeover fraud, for example, is an increasing threat to financial institutions, which saw a 90 percent increase in account takeover losses from 2020 to 2021. By making account takeover fraud prevention a priority, financial institutions can alleviate risks and prevent major losses. How to build an effective fraud strategy in 2024 In 2024, fraud management solutions must be even more technically advanced than the fraudulent techniques they're combating. But more than that, they need to be appealing to consumers, who are likely to abandon signup or purchase attempts when they become too onerous. In fact, 37% of consumers have moved their business elsewhere due to a negative account opening experience. Worryingly for businesses, this number was even higher among high-income households and those aged 25 to 39. To succeed, effective fraud strategies must be seamless, low friction, data-driven and customer-focused. That means making use of up-to-date technologies that boost security while prioritizing a positive customer experience.  Concerned about fraud? Let Experian help As we look back at the top fraud trends of 2023, it's clear that scammers are becoming increasingly sophisticated in their methods. Fraud can create huge risks for your business — but there are ways to act. Experian's suite of fraud prevention and identity verification tools can help you detect and combat fraud. Find out more about Experian's fraud risk management strategies and how they can help keep you and your customers safe. Learn more

Financial institutions are under increasing pressure to grow deposits and onboard more demand deposit accounts (DDA). But as demand increases, so do fraud attempts from scammers. While a robust mitigation effort is needed to stop fraud, this same effort can also drive away potential clients. In fact, 37 percent of U.S. adults said that they abandoned opening an account online due to experiencing friction. This leaves institutions in a unique quandary: how do they stop DDA fraud without scaring away potential clients? The answer lies in utilizing robust, machine learning tools that can help you navigate fraud attempts without increasing onboarding friction.  Chris Ryan, Go to Market Lead for Experian Identity and Fraud, shares his thoughts on demand deposit account fraud and which decisioning tools can best combat it.   Q: What is a demand deposit account and how is it used? "Demand deposit is just your basic checking account," Ryan explains." The funds are deposited and held by an institution, which enables you to spend those assets or resources, whether it be through checks, debit cards, person-to-person, Automated Clearing House (ACH) — all the things we do every day as consumers to manage our operating budget."  Q: What is demand deposit account fraud?   "There are two different ways that demand deposit account fraud works," Ryan says. "One is with existing account holders, and the other is with the account opening process.” When fraud affects existing account holders, it typically involves tricking an account holder into sending money to a scammer or using fraudulent actions, like phishing emails or credit card skimmers, to gain access to their accounts. There is also a resurgence in fraud involving duplication, theft and forgery of paper checks, Ryan explains.   Fraud impacting the account opening process occurs when scammers originate new DDAs. This can work in a variety of ways, such as these three examples:  A scammer steals your identity and opens an account at the same bank where you have a home equity loan. They link their DDA to your line of credit, transferring your money into their new account and withdrawing the funds.  A scammer uses a synthetic identity (SID) to open a fraudulent DDA. They will then use this new DDA to open more lucrative accounts that the institution cross-sells to them. A scammer uses a stolen or SID to open “mule” accounts to receive funds they dupe consumers into sending through fake relationship schemes, bogus merchandise sales and dozens of similar scams. While both types of fraud need to be dealt with, account opening fraud can have especially large repercussions for lenders or financial institutions.  Q: What are the consequences of DDA fraud for organizations?   "Fraud hurts in a number of ways," Ryan explains. "There are direct losses, which is the money that criminals take from our financial system. Under most circumstances, the financial institution replaces the money, so the consumer doesn’t absorb the loss, but the money is still gone. That takes money away from lending, community engagement and other investments we want banks to make. The direct losses are what most people focus on."  But there are even more repercussions for institutions beyond losing money, and this can include the attempts that institutions put into place to stop the fraud. "Preventing fraud requires some friction for the end consumer," Ryan says. "The volume of fraudulent attempts is overwhelmingly large in the DDA space. This forces institutions to apply more friction. The friction is costly, and it often drives would-be-customers away. The results include high costs for the institutions and low booking rates. At the same time, institutions are hungry for deposit money right now. So, it's kind of a perfect storm."  Q: What is the impact of DDA fraud on customer experience?  Experian’s 2023 Identity and Fraud Report revealed that up to 37 percent of U.S. adults in the survey had abandoned a new account entirely in the previous six months because of the friction they encountered during onboarding. And 51 percent reported considering abandoning the process because of problems they encountered. Unfortunately, fraud mitigation and deposit fraud detection efforts can end up driving customers away. "People can be impatient," Ryan says, "and in the online world, a competing product is a mouse-click away. So, while it is tempting to ask new applicants for more information, or further proof of identity, that conflicts with their need for convenience and can impact their experience.” Companies looking for cheap and fast mitigation can end up impeding customers trying to onboard to sweep out the bad actors, Ryan explains. "How do you get the bad people without interrupting the good people?" Ryan asks. "That's the million-dollar question."  Q: What are some other problems with how organizations traditionally combat DDA fraud?   Unfortunately, traditional attempts to combat DDA fraud are inefficient due to the fragmentation of technology. Ryan says this was revealed by Liminal, an industry analyst think tank.  "Nearly half of institutions use four-or-more-point solutions to manage identity and fraud-related risk," Ryan explains. "But all of those point solutions were meant to work on their own. They weren't developed to work together. So, there's a lot of overlap. And in the case of fraud, there's a high likelihood that the multiple solutions are going to find the same fraud. So, you create a huge inefficiency."   To solve this challenge, institutions need to shift to integrated identity platforms, such as Experian CrossCore®.  Q: How is Experian trying to change the way organizations approach DDA fraud?   Experian is pushing a paradigm shift for institutions that will increase fraud detection efficiency and accuracy, without sacrificing customer experience. "Organizations need to start thinking of identity through a different lens," Ryan says.   Experian has developed an identity graph that aggregates consumer information in a manner that reaches far beyond what an institution can create on its own. "Experian is able to bring the entire breadth of every identity presentation we see into an identity graph," Ryan says. "It's a cross-industry view of identity behavior." This is important because people who commit fraud manipulate data, and those manipulations can get lost in a busy marketplace.   For example, Ryan explains, if you're newly married, you may have recently presented your identity using two different surnames: one under your maiden name and one under your married name. Traditional data sources may show that your identity was presented twice, but they won’t accurately reflect the underlying details; like the fact that different surnames were used. The same holds true for thousands of other details seen at each presentation but not captured in a way that enables changes over time to be visible, such as information related to IP addresses, email accounts, online devices, or phone numbers.   "Our identity graph is unlocking the details behind those identity presentations," Ryan says. "This way, when a customer comes to us with a DDA application, we can say, 'That's Chris's identity, and he's consistently presenting the same information, and all that underlying data remains very stable.'"   This identity graph, part of Experian's suite of fraud management solutions — also connects unique identity details to known instances of fraud, helping catch fraudulent attempts much faster than traditional methods. "Let's say you and your spouse share an address, phone numbers, all the identity details that married couples typically share," Ryan explains. "If an identity thief steals your identity and uses it along with a brand-new email and IP address not associated with your spouse, that might be concerning. However, perhaps you started a new job, and the email/IP data is legitimate. Or maybe it’s a personal email using a risky internet service provider that shares a format commonly used by a known ring of identity thieves. Traditional data might flag the email and IP information as new, but our identity graph would go several layers deeper to confirm the possible risks that the new information brings.  Q: Why is this approach superior to traditional methods of fraud detection?  "Historically, organizations were interested in whether an identity was real,” Ryan says. "The next question was if the provided data (I.e., addresses, date of birth, Social Security numbers, etc.) have been historically associated with the identity. Last, the question would be whether there’s known risk associated with any of the identity components.” The identity graph turns that approach upside down.   "The identity graph allows us to pull in insights from past identity presentations, " Ryan says. "Maybe the current presentation doesn’t include a phone number. Our identity graph should still recognize previously provided phone numbers and the risks associated with them. Instead of looking at identity as a small handful of pieces of data that were given at the time of the presentation, we use the data given to us to get to the identity graph and see the whole picture."  Q: How are businesses applying this new paradigm?  The identity graph is part of Experian's Ascend Fraud Platform™ and a full suite of fraud management solutions. Experian's approach allows companies to clean out fraud that already occurred and stop new fraudulent actors before they're onboarded. "Ideally, you want to start with cleaning up the house, and then figure out how to protect the front door," Ryan says.  In other words, institutions can start by applying this view to recently opened accounts to identify problematic identities that they missed. The next step would be to bring these insights into the new account onboarding process.  Q: Is this new fraud platform accessible to both small and large businesses?  The Ascend Fraud Platform will support several use cases that will bring value to a broad range of businesses, Ryan explains. It can not only enable Experian experts to build and deliver better tools but can enable self-serve analytical development too. "Larger organizations that have robust, internal data science capabilities will find that it’s an ideal environment for them to work in," Ryan says. "They can add their own internal data assets to ours, and then have a better place to develop analytics. Today, organizations spend months assembling data to develop analytics internally. Our Ascend Fraud Platform will reduce the timeline of the data assembly and analytical development process to weeks, and speed to market is critical when confronting continually changing fraud threats. "But for customers who have less robust analytical teams, we're able to do that on their behalf and bring solutions out to the marketplace for them," Ryan explains.   Q: What type of return on investment (ROI) are businesses experiencing?  "Some customers recover their investment in days," Ryan says. "Part of this is from mitigating fraud risks among recently opened accounts that slipped through existing defenses.”     "In addition to reducing losses, institutions we're working with are also seeing potentially millions of dollars a month in additional bookings, as well as significant cost savings in their account opening processes," Ryan says.  "We're able to help clients go back and audit the people who had fallen out of their process, to figure out how to fine-tune their tools to keep those people in," Ryan says.   “By reducing risks among existing accounts, better protecting the front door against future fraud, and growing more efficiently, we’re helping clients  Q: What are Experian's plans for this service?   "We're working with top-tier financial institutions on the do-it-yourself techniques," Ryan says. "In parallel, we're launching our first offerings that are created for the broader marketplace. That will start with the portfolio review capability, along with making the most predictive attributes available through our integrated identity resolution platform. And while the Ascend Fraud Platform has a strong use case for DDA fraud, its uses extend beyond that to small business lending and other products. In fact, Experian offers an entire suite of fraud management solutions to help keep your DDA accounts secure and your customers happy.   Experian can help optimize your DDA fraud detection  Experian is revolutionizing the approach to combating DDA fraud, helping institutions create a faster onboarding process that retains more customers, while also stopping more bad actors from gaining access. It's a win-win for everyone.   Experian's full suite of fraud management solutions can optimize your business's DDA fraud detection, from scrubbing your current portfolio to gatekeeping bad actors before they're onboarded.  Learn more Speak with a specialist About our expert: Chris Ryan has over 20 years of experience in fraud prevention and uses this knowledge to identify the most critical fraud issues facing individuals and businesses in North America, and he guides Experian’s application of technology to mitigate fraud risk.

In today's fast-paced digital world, the risk of fraud across all industries is a constant threat. The traditional methods of fraud detection are no longer sufficient, as fraudsters become increasingly sophisticated in their attacks. However, with artificial intelligence (AI) and machine learning (ML) solutions, financial institutions can stay one step ahead of fraudsters. AI and machine learning-equipped fraud detection tools have the ability to identify suspicious activity and patterns of fraud that are imperceptible to the human brain. In this blog post, we’ll dive into the significance of AI and machine learning in fraud detection and how these solutions are uniquely equipped to handle the demands of modern-day risk management. Understanding artificial intelligence and machine learning AI and machine learning solutions are transformative technologies that are reshaping the landscape of many industries. AI, at its core, is a field of computer science that simulates human intelligence in machines, enabling them to learn from experience and perform tasks that normally require human intellect. Machine learning, a subset of AI, is the science of getting computers to learn and act like humans do, but with minimal human intervention. They can analyze vast amounts of data within seconds, identifying patterns and trends that would be impossible for a human to recognize. When it comes to fraud detection, this ability is invaluable.  Advantages of fraud detection using machine learning AI and machine learning have several benefits that make them valuable in fraud detection. One significant advantage is that these technologies can recognize patterns that are too complex for humans to identify. By running through a vast set of data points, these solutions can pinpoint anomalous behavior, and thereby prevent financial losses. AI analytics tools are adept at monitoring complex networks, detecting the dispersion of attacks that may involve multiple individuals and entities, and correlating activity patterns that would otherwise be hidden. Machine learning algorithms can take these patterns and turn them into mathematical models that help identify instances of fraud before the damage takes place. Secondly, they continuously learn from new data, which allows them to become more efficient in identifying fraud as they process more data. Thirdly, they automate fraud mitigation processes, which significantly reduces the need for manual interventions that may consume valuable time and resources. Another significant benefit of machine learning is its analytics capabilities, which allow organizations to gain valuable insights into customer behavior and fraud patterns. With AI analytics, they can detect and investigate fraudulent activities in real-time, and combine it with other tools to help detect and mitigate fraud risk. For example, in financial services, AI fraud detection can help banks and financial service providers detect and prevent fraud in their systems, add value to their services and improve customer satisfaction. The future of fraud detection and machine learning The rate at which technology is evolving means that machine learning and AI fraud detection will become increasingly important in the future. In the next few years, we can expect a more sophisticated level of fraud detection using unmanned machine systems, robotics process automation, and more. Ultimately, this will improve the efficiency and effectiveness of fraud detection.AI-based fraud management solutions are taking center stage. Organizations must leverage advanced machine learning and AI analytics solutions to prevent and mitigate cyber risks and comply with regulatory mandates. The benefits extend far beyond the financial bottom line to improving the safety and security of customers. AI and machine learning solutions offer accurate, efficient and proactive routes to managing the risk of fraud in an ever-changing environment. How can Experian® help Integrating machine learning for fraud detection represents a significant advancement in cybersecurity. Fraud management solutions detect, prevent and manage fraud across all industries, including financial services, healthcare and telecommunications. With the advancement of technology, fraud management solutions now integrate machine learning to improve their processes. Experian® provides fraud prevention solutions, including machine learning models and AI analytics, which can help more effectively mitigate fraud risk, streamline fraud investigations and create a more secure digital environment for all. With Experian’s AI analytics, risk mitigation tools and fraud management solutions, organizations can stay one step ahead of fraudsters and protect their brand reputation, customer trustworthiness and corporate data. Embracing these solutions can save organizations from significant losses, reputational damage and regulatory scrutiny. To learn more about how to future-proof your business and safeguard your customers from fraud, check out Experian’s robust suite of fraud prevention solutions. Want to hear what our industry experts think? Check out this on-demand webinar on artificial intelligence and machine learning strategies. *This article includes content created by an AI language model and is intended to provide general information.

Sometimes logging into an account feels a bit like playing 20 questions. Security is vital for a positive customer experience, and engaging the right identity verification strategies is essential to proactive fraud prevention. For financial institutions and businesses, secure authentication is more important than ever. It is imperative for customer safety – which drives retention and loyalty – and your bottom line – as fraud has determinantal effects on and off the balance sheet. Information sharing has proliferated, as has the number of times consumers are prompted to provide access to sensitive information. While today’s consumer has grown accustomed to providing such information, there’s also a heightened demand for security. According to Experian’s 2023 U.S. Identity and Fraud Report, nearly two-thirds (64%) of consumers say they’re very or somewhat concerned with online safety, listing identity theft, stolen card information and online privacy as top concerns. Customers want to know who they are providing access to and whether that entity will have their safety in mind. From a business perspective, one way to ensure that only the right people can get in is by using (KBA). KBA takes traditional authentication methods, like passwords and Personal Identification Numbers (PINs), one step further by creating an additional layer of security through collecting private facts from each user. In this post, we'll look at how KBA works, what its benefits are as a form of identity verification, and how it can improve customer trust. Introducing Knowledge Based Authentication (KBA): What it is and how it works Knowledge Based Authentication can be part of a multifactor authentication solution and is one way to stay on top of privacy and security for your customers – existing and new. KBA is a feature designed to protect online accounts by verifying the account holder’s identity. It involves answering a series of personal questions, such as mother's maiden name or first pet's name, that only the account holder should know. This system has become increasingly popular due to its effectiveness in preventing fraud and identity theft. With KBA, businesses and individuals can have peace of mind that their information is protected by a reliable authentication system that is difficult for unauthorized users to breach. Benefits of implementing KBA and a multifactor authentication strategy By implementing KBA into your business, customers experience an additional layer of security by verifying the identity of users through personalized questions. This reduces the risk of fraud and enhances customer trust and confidence. Secondly, it improves the customer experience by making the authentication process faster and user-friendly. Lastly, KBA reduces costs by automating the authentication process and reducing the need for manual intervention. However, KBA is just one facet of an ideal strategy. Multifactor authentication provides confidence while reducing friction. Risk-based authentication tools allow organizations to assess risk to apply the appropriate level of security. Factors to consider adding to your authentication processes include: Generating unique one-time passwords (OTPs): By creating a new OTP for each transaction, you can increase the level of security. Confirm device ownership: A multifactored approach applies device intelligence checks to increase confidence that the message is reaching the correct user. Maintain low friction with secondary options: If the OTP fails or can’t be attempted by the user, working with a provider who allows an automatic default to another authentication service, such as a knowledge-based authentication solution, decreases end-user friction. Identifying potential security risks associated with KBA KBA relies on personal information that may easily be discovered via social media and other public records, which makes it vulnerable to fraud and identity theft. This highlights the need for a multilayered fraud and identity solution. The landscape of digital security is constantly changing, leveraging an arsenal of fraud and identity prevention strategies, like document verification, one-time passcode, and various identity authentication and verification measures, is critical for keeping your customers and business safe. Commonly used technologies for enhancing KBA security With the rising need for secure authentication, KBA systems have become increasingly popular. However, cyberthreats evolve at an alarming rate, making it imperative to stay current with the latest fraud schemes and how to enhance and supplement your security. Biometrics, like facial recognition and fingerprint scans, as a tactic is gaining traction, as evidenced by “85% of consumers report physical biometrics as the most trusted and secure authentication method they have recently encountered,” according to Experian’s 2023 U.S. Identity and Fraud Report. Additionally, machine learning algorithms detect patterns and anomalies in user behavior and flag any potential security breaches. Multi-factor authentication is another tool that adds an extra layer of security by requiring users to provide multiple forms of identification before logging in. Keeping up with these and other technological advancements can help ensure your KBA system stays one step ahead of potential cyberattacks. Interestingly, there’s a disconnect between the technologies consumers feel safe with and/or are prepared to use versus the technologies and strategies that organizations implement. According to the U.S. Identity and Fraud Report, biometrics are only currently used by 33% of businesses to detect and protect against fraud. An opportunity for business differentiation and driving customer loyalty through a better customer experience may be tapping into some of these lesser used – but sought after – technologies. Compliance with industry standards regarding KBA Ensuring that your system complies with industry standards regarding KBA is crucial for protecting sensitive information from unauthorized access. By implementing the following tips, you can stay ahead of the game and safeguard your organization's data. Analyze your system's current authentication methods and evaluate if they meet industry standards. Additionally, follow standard guidelines for data storage and encryption, limit access to only authorized personnel, and y current with regulations. Lastly, conduct frequent security audits and perform vulnerability tests to identify and address any potential threats. Knowledge-based authentication offers a robust security solution for businesses of all sizes, and incorporating KBA as part of a multifactor authentication strategy is a winning course of action. It provides an added layer of protection for personal data, encourages user accountability, and safeguards against unauthorized access. By leveraging appropriate KBA technologies and maintaining compliance with industry standards, it is possible to create a secure system for customers that gives you peace of mind for your business and bottom line. Experian can help you with knowledge-based authentication offerings, a multifactor authentication strategy and everything in between to enhance your existing authentication process without causing user fatigue. Increase your pass rates, confirm device ownership and add security to risky or high-value transactions, all while executing identity verification and fraud detection to protect your business from risk. The most important step is getting started. Learn more

It's that magical time of the year! The holiday season is fast approaching, and folks everywhere are gearing up for festive travels and family reunions. Unfortunately, holiday travel can sometimes lead to unforeseen circumstances, such as fraudulent activities orchestrated by scammers who impersonate property owners on well-known vacation rental platforms. These fraudsters employ schemes designed to deceive unsuspecting travelers into making payments through unsecured channels, resulting in significant financial losses for the gullible victims.  Digital identity and hotel fraud Airline and hotel fraud encompasses illicit activities aimed at airlines, hotels, booking platforms, and other travel accommodation services, including car rentals and excursions. These services often utilize loyalty programs to incentivize repeat patronage through point-based rewards. The widespread adoption of such loyalty programs has extended their appeal beyond the travel and hospitality sectors, consequently attracting fraudulent activities. Perpetrators of airline and hospitality fraud employ a range of tactics and different techniques to execute their schemes, leveraging various online forums, marketplaces, shops, and public messaging platforms. Hotels are custodians of valuable guest data, encompassing contact information and payment details. Their operational model involves serving a large pool of potential customers who are making limited visits. Consequently, compromising a hospitality employee's account could grant an identity thief access to millions of consumer records. Moreover, hotel employees are frequent targets of foreign governments aiming to procure confidential travel records to facilitate the tracking of specific individuals and groups. In contrast, restaurants primarily store transaction records with fewer customer details. However, the landscape is evolving as more establishments adopt online ordering capabilities and loyalty programs. At present, cybercriminals typically focus on the high volume of point-of-sale transactions.  As travel booms, fraudsters find new paths According to a recent Deloitte survey, Intent to travel between Thanksgiving and mid-January is up across all age and income groups. While reconnecting with friends and family remains paramount to travel during the holidays, fewer Americans are restricting their travel to visiting loved ones. The share of travelers planning to stay in hotels surged to 56%. Fraudsters will always take advantage of current circumstances, and with more people traveling again, they have taken notice — and action. The following techniques have been identified as the most employed by cybercriminals to target customers of airlines, hotels, and hospitality-related organizations:  Travel-themed phishing and fraudulent travel agency operations, sales, and advertisements of travel fraud-related tutorials.  Sales of compromised networks, user accounts, and databases containing reward/loyalty points and personally identifiable information (PII) that could be utilized for social engineering, money laundering, and other attack vectors.  Since the emergence of cyber-enabled crime, services and activities facilitating travel fraud have been extensively promoted and sought after by threat actors. Cybercriminals mainly leverage stolen card-not-present (CNP) data and reward/loyalty points obtained from compromised bank accounts to procure flights, accommodations, and other travel-related services.  Furthermore, threat actors persistently refine their strategies for harvesting reward/loyalty points through compromised accounts, deceiving victims into disclosing their travel-related documentation and data and circulating updated guidelines for circumventing hotel and airline reservation services, amongst other activities.  Protecting travelers and improving the customer experience   Combatting hospitality and hotel fraud requires collaboration between industry stakeholders, government entities, and financial institutions. Travel professionals should focus on: Enhancing data security: Invest in robust cybersecurity measures to protect guest information, payment systems for CNP, and loyalty programs.  Implementing identity verification: Utilize advanced technologies, such as biometric authentication and behavioral analytics, to verify guests' identities and prevent account fraud.  Educating staff and guests: Provide comprehensive training to employees on recognizing and reporting suspicious activities. Educate guests about potential scams and advise them to book directly through official channels.  Sharing information: Establish platforms to share intelligence and best practices to stay ahead of evolving fraud techniques.  Acting with the right solution As the travel and hospitality industry continues to thrive, so does the risk of hospitality fraud. Travelers and hoteliers alike must remain vigilant to protect their finances from various fraud schemes prevalent today. By staying informed, taking proactive measures, and fostering collaborative efforts, we can create a safer and more secure environment within the travel industry.  Experian’s identity verification solutions power advanced capabilities across the travel lifecycle. With trusted data and advanced analytics, you can gain a complete view of your future guest to improve risk management and offer an enhanced, frictionless customer experience.   Learn more *This article leverages/includes content created by an AI language model and is intended to provide general information.

The gig economy — also called the sharing economy or access economy — is an activity where people earn income by providing on-demand work, services, or goods. Often, it is through a digital platform like an application (app) or website. The gig economy seamlessly connects individuals with a diverse range of services, whether it be a skilled handyman for those long-awaited office shelves, or an experienced chauffeur to quickly drive you to the airport to not miss your flight. However, there are instances when these arrangements fall short of expectations. The hired handyman may send a substitute who’s ill-equipped for the task, or the experienced driver takes the wrong shortcut leaving you scrambling to make your flight on time. On the flip side, there are numerous risks faced by those working in the gig/sharing economy, from irritable customers to dangerous situations. In such cases, trust takes a hit. The gig economy has witnessed a surge in recent years, as individuals gravitate towards flexible, freelance, and contract work instead of traditional full-time employment. This shift has unlocked a multitude of opportunities for both workers and businesses. Nevertheless, it has also ushered in challenges pertaining to security and trust. One such challenge revolves around the escalating significance of digital identity verification within the gig economy.  Digital identity verification and the gig economy  Digital identity verification encompasses validating a person's identity through digital means, such as biometric data, facial recognition, or document verification. Within the gig economy, this process has high importance, as it establishes trust between businesses and their pool of freelance or contract workers. With the escalating number of remote workers and the proliferation of online platforms connecting businesses with gig workers, verifying the identities of these individuals has become more vital than ever before.  Protecting gig users and improving the customer experience   One primary rationale behind the mounting importance of digital identity verification in the gig economy is its role in curbing fraud. As the gig economy gains traction, the risk of individuals misrepresenting themselves or their qualifications to secure work burgeons. This scenario can lead businesses to hire unqualified or even fraudulent workers, thereby posing severe repercussions for both the company and its customers. By adopting digital identity verification processes, businesses can ensure the legitimacy and competence of their workforce, subsequently decreasing the risk of fraudulent activities.  In the digital age, trust and safety are crucial for businesses to succeed. Consumers prioritize brands they can trust, and broken trust can lead to loss of customers.According to Experian's 2023 Fraud and Identity Report, over 52% of US consumers feel they’re more of a target for online fraud than they were a year ago. As such, online security continues to be a real concern for most consumers. Nearly 64% of consumers say that they are very or somewhat concerned with online security, with 32% saying they are very concerned. Establishing trust and safety measures not only protects your brand but also enhances the user experience, fosters loyalty, and boosts your business.    Role of a dedicated Trust and safety team  Trust and safety are the set of business practices for online platforms to follow to reduce the risk of users being exposed to harm, fraud, or other behaviors outside community guidelines. This is becoming an increasingly important function as online platforms look to protect their users while improving customer acquisition, engagement, and retention.  That team also safeguards organizations from security threats and scams. They verify customers' identities, evaluate actions and intentions, and ensure a safe environment for all platform users. This enables both organizations and customers to trust each other and have confidence in the platform. Their role has evolved from fraud prevention to encompass broader areas, such as user-generated content and the metaverse. With the rise of user-generated content, platforms face challenges like fake accounts, imitations, malicious links, and inappropriate content. As a result, trust and safety teams have expanded their focus and are involved in product engineering and customer journey design. Another noteworthy factor contributing to the growing emphasis on digital identity verification for trust and safety teams stems from the necessity to adhere to diverse regulations and laws. Many countries have implemented stringent regulations to safeguard workers and ensure the legal and ethical operations of businesses. In the United States, for instance, businesses must verify the identities and work eligibility of all employees, including freelancers and contractors, as part of the Form I-9 process. By leveraging digital identity verification tools, businesses can streamline these procedures and guarantee compliance with prevailing regulations.  Mitigating risk in online marketplaces  To mitigate risks in online marketplaces, businesses can take several steps, including creating a clear set of user guidelines, implementing identity verification during onboarding, enforcing multi-factor authentication for all accounts, leveraging reverification during high-risk moments, performing link analysis on the user base, and applying automation. Online identity verification plays a pivotal role in safeguarding gig workers themselves. With the surge of online platforms connecting businesses with freelancers and contractors, there comes an augmented risk of workers falling prey to scams or identity theft. By mandating digital identity verification as an integral part of the onboarding process, these platforms can shield workers and ensure they only engage with bona fide businesses.  While automation can be a powerful tool for fraud detection and mitigation, it is not a cure-all solution. Automated identity verification has its strengths, but it also has its weaknesses. While automation can spot risk signals that a human might miss, a human might spot risk signals that automation would have skipped. Therefore, for many companies, the goal should not be full automation but achieving the right ratio of automation to manual review. Manual review takes time, but it's necessary to ensure that all potential risks are identified and addressed. The more efficient these processes can be, the better, as it allows for a quicker response to potential threats. As the number of individuals embracing freelance and contract work surges, and businesses increasingly rely on these workers to carry out vital responsibilities, ensuring the security and trustworthiness of these individuals becomes paramount. By integrating digital identity verification processes, businesses can shield themselves against fraud, comply with regulations, and cultivate trust with their gig workers.  Finding the right partner While trust and safety are concerns for all online marketplaces, there’s no universal solution that will apply to all businesses and in all cases. Your trust and safety policies need to be tailored to the realities of your business. The industries you serve, regions you operate in, regulations you are subject to, and expectations of your users should all inform your processes. Experian’s comprehensive suite of customizable identity verification solutions can help you solve the problem of trust and safety once and for all.  Learn more *This article leverages/includes content created by an AI language model and is intended to provide general information.

This article was updated on April 23, 2024. Keeping your organization and consumers safe can be challenging as cybercriminals test new attack vectors and data breaches continually expose credentials. Instead of relying solely on usernames and passwords for user identity verification, adding extra security measures like multi-factor authentication can strengthen your defense. What is multi-factor authentication? Multi-factor authentication, or MFA, is a method of authenticating people using more than one type of identifier. Generally, you can put these identifiers into three categories based on the type of information: Something a person knows: Usernames, passwords, and personal information are common examples of identifiers from this category. Something a person has: These could include a phone, computer, card, badge, security key, or another type of physical device that someone possesses. Something a person is: Also called the inherence factor, these are intrinsic behaviors or qualities, such as a person's voice pattern, retina, or fingerprint. The key to MFA is it requires someone to use identifiers from different categories. For example, when you withdraw money from an ATM, you're using something you have (your ATM card or phone), and something you know (your PIN) or are (biometric data) to authenticate yourself. Common types of authenticators Organizations that want to implement multi-factor authentication can use different combinations of identifiers and authenticators. Some authenticator options include: One-time passwords: One-time passwords (OTPs) can be generated and sent to someone's mobile phone via text to confirm the person has the phone or via email. There are also security tokens and apps that can generate OTPs for authentication. (Something you know.) Knowledge-based authentication: Knowledge-based authentication (KBA) identity verification leverages the ability to verify account information or a payment card, “something you have,” by confirming some sequence of numbers from the account. (Something you know.) Security tokens: Devices that users plug into their phone or computer, or hold near the device, to authenticate themselves. (Something you have.) Biometric scans: These can include fingerprint and face scans from a mobile device, computer, or security token. (Something you are.) Why MFA is important It can be challenging to keep your users and employees from using weak passwords. And even if you enforce strict password requirements, you can't be sure they're not using the same password somewhere else or accidentally falling for a phishing attack. In short, if you want to protect users' data and your business from various types of attacks, such as account takeover fraud, synthetic identity fraud, and credential stuffing, you’ll need to require more than a username and password to authenticate users. That’s where MFA comes in. Because it uses a combination of elements to verify a consumer’s identity, if one of the required components in a transaction is missing or supplied incorrectly, the transaction won’t proceed. As a result, you can ensure you’re interacting with legitimate consumers and protect your organization from risk. LEARN MORE: Explore our fraud prevention solutions. How to provide a frictionless MFA experience While crucial to your organization, in-person and online identity verification shouldn’t create so much friction that legitimate consumers are driven away. Experian's 2023 U.S. Identity and Fraud Report found that 96 percent of consumers view OTPs as convenient identity verification solutions when opening a new account. An increasing number of consumers also view physical and behavioral biometrics as some of the most trustworthy recognition methods — 81 and 76 percent, respectively. To create a low friction MFA experience that consumers trust, you could let users choose from different MFA authentication options to secure their accounts. You can also create step-up rules that limit MFA requests to riskier situations — such as when a user logs in from a new device or places an unusually large order. To make the MFA experience even more seamless for consumers, consider adding automated identity verification (AIV) to your processes. Because AIV operates on advanced analytics and artificial intelligence, consumers can verify their identities within seconds without physical documentation, allowing for a quick, hassle-free verification experience. How Experian powers multi-factor authentication Experian offers various identity verification and risk-based authentication solutions that organizations can leverage to streamline and secure their operations, including: Experian’s CrossCore® Doc Capture confidently verifies identities using a fully supported end-to-end document verification service where consumers upload an image of a driver’s license, passport, or similar directly from their smartphone. Experian’s CrossCore Doc Capture adds another layer of security to document capture with a biometric component that enables the individual to upload a “selfie” that’s compared to the document image. Experian's OTP service uses additional verification checks and identity scoring to help prevent fraudsters from using a SIM swapping attack to get past an MFA check. Before sending the OTP, we verify that the number is linked to the consumer's name. We also review additional attributes, such as whether the number was recently ported and the account's tenure. Experian's Knowledge IQSM offers KBA with over 70 credit- and noncredit-based questions to help you engage in additional authentication for consumers when sufficiently robust data can be used to prompt a response that proves the person has something specific in their possession. You can even configure it to ask questions based on your internal data and phrase questions to match your brand's language. Learn more about how our multi-factor authentication solutions can help your organization verify consumer identities and mitigate fraud. Learn about our MFA solutions

  Managing digital identities is a necessity, responsibility and privilege. When done right, digital identity management solutions can help consumers feel recognized and safe. In turn, companies can build strong and personalized relationships with their customers while complying with regulatory requirements and combating hydra-like fraud attacks. What is digital identity? The concept and definition of a digital identity have expanded as everyday interactions increasingly happen in digital realms. Today, a digital identity is more than an online account. Identities can be created and depend on all the digital information associated with a unique entity, which may be a person, business or device. A person's digital identity often includes online and offline attributes that fall into one of three categories: Something a user knows, such as a username, password or PIN. Something a user has, such as a mobile phone or security token. Something that's part of the user, such as a fingerprint, iris, voice pattern, behavior or preferences. People are increasingly open to sharing this type of personal information if it serves a purpose. Our Global Identity and Fraud Report found that 57 percent of consumers are willing to share data if it ensures greater security or prevents fraud, and 63 percent of consumers think sharing data is beneficial (up from 51 percent in 2021).1 People can also use these identifiers to verify their identity at a later point. But digital identity verification tools should rely on more than user-provided verification alone. A person may have hundreds or thousands of digital interactions every day, and these can leave digital footprints that you can use to create or expand digital identities. These types of identifiers — such as search queries, geotags, behaviors and device information — can also help you authenticate a user and offer a more customized and seamless experience. However, when focusing on consumers' digital identities, it's important to remember that their identity is more than the sum of data points. A person's digital identity is unique and personal, and it should be managed accordingly. The business side's challenges A discussion of what makes up an identity can quickly turn philosophical. For instance, you can't authenticate identical twins based on a face scan or DNA test, so what is it that makes them unique? In some ways, the example gets to the heart of businesses' challenges today. To create a safe and enjoyable online identity verification experience, you need to be able to distinguish between a real person and an imitator, even when the two look nearly identical. Access to more information can make this easier, but you then need to ensure that you can keep this information secure. It can be a tricky balance, but if you get it right, your efforts will be rewarded. People want to be recognized as they move across channels and devices, and organizations want to be able to quickly and accurately identify users with a friction-right experience that also helps prevent fraud. However, while 84 percent of businesses say recognizing customers is "very" or "extremely" important, only about 33 percent of consumers are confident that they'll be repeatedly recognized online.1 There's a clear gap — and an opportunity to better meet customers' desires. Organizations across industries know they need a customer recognition strategy and 82% already have one in place.2 Some businesses address this challenge with identity platforms that are standardized and interoperable. Standardization allows the platform to gather and store the growing influx of data that it can use as part of a digital identity strategy. Interoperability allows the platform to match different types of data, including physical data, with a person to verify their digital identity and avoid the creation of duplicate identities. In short, the platforms can make sense of increasingly large amounts of internal and external data and easily incorporate new data sources as they become available. Regulatory compliance and digital identity Navigating the regulatory landscape is a significant challenge for organizations dealing with digital identities. Compliance is not only necessary for legal reasons but also critical to maintaining customer trust and safeguarding institutional reputation. Organizations must stay informed about the regulatory frameworks that affect digital identity, such as the General Data Protection Regulation (GDPR) in the European Union, the California Consumer Privacy Act (CCPA), and other pertinent laws in jurisdictions they operate. These regulations dictate how personal data can be collected, stored, used and shared. Staying ahead of regulatory changes: Regulatory landscapes are dynamic, particularly concerning digital data. Organizations should engage with policymakers and participate in industry forums to  stay ahead of changes. By proactively managing compliance, organizations can avoid costly penalties, operational disruptions and reputational damage. The consumer's perspective Some organizations are adopting a consumer-centric approach to digital identity that puts consumers' needs and desires first. These can broadly be broken into four categories: Security: While people want a seamless and personalized experience, security and privacy are listed as top concerns year after year.1 That might not be surprising given that data breaches continually make headlines and there are growing concerns over identity theft. Privacy: Security is related to privacy, but privacy means more than keeping consumers' information safe from hackers. Our April 2022 Global Insight Report found that 90 percent of consumers want some or complete control over how their personal data is used. 3 Recognition: People want to be continually recognized once they share and verify their identity, even if they move between devices or channels. And nearly 70 percent of consumers say it's important for businesses to recognize them across multiple visits.1 Inclusion: Consumers may have varying levels of access to technology, comfort with technology and access to physical identifiers. Creating digital identity solutions for these potential barriers can also increase financial inclusion. While these are all areas of focus, organizations also need to find the right fit for each person and interaction. For instance, consumers may expect and even appreciate a robust verification process when they're opening a new financial account. But they could quickly be turned off by a similar process if they're making a small purchase or trying to play a new online game. What to look for in a digital identity partner Digital identity solutions and services have grown increasingly sophisticated to meet today's challenges. Identity hubs and data orchestration engines can connect with multiple services to help create, resolve, verify and authenticate identities. By moving away from a siloed approach, businesses can offer customers a better experience while minimizing their risk throughout the customer journey. When comparing potential partners, look for a company that: Has a customer-first approach: If your business is customer-first, then you need a partner who has a similar view. Uses multidimensional data: The partner should be able to offer and use offline and digital data sources to resolve, verify and authenticate digital identities. Its capabilities may become increasingly important as new data sources emerge. Isn't afraid to innovate: Look into how the partner is testing and using the latest advancements, such as artificial intelligence, in its digital identity solutions. Protects your brand: Understand how the partner helps detect and prevent fraud while creating a seamless experience for your customers and protecting their data. The right partner can increase your bottom line, help you build trust and improve your brand's reputation. Learn more about Experian Identity, an integrated approach to digital identity that builds on Experian's decades of experience managing and securing identifying information. Learn more 1“2022 Global Identity and Fraud Report: Building digital consumer trust amidst rising fraud activity and concerns," Experian, June 2022 2“2021 Global Identity and Fraud Report: Protecting and enabling customer engagements in the new digital era," Experian, April 2021. https://www.experian.com/content/dam/marketing/na/global-da/pdfs/GIDFR_2022.pdf https://www.experian.co.th/wp-content/uploads/2021/04/Experian-Global-Identity-Fraud-Report-2021.pdf 3"Global Insights Report: April 2022," Experian, April 2022. https://www.experian.com/blogs/global-insights/wp-content/uploads/2022/04/WaveReportApril2022.pdf *This article includes content created by an AI language model and is intended to provide general information.

This article was updated on November 9, 2023. Fraud – it’s a word that comes up in conversations across every industry. While there’s a general awareness that fraud is on the rise and is constantly evolving, for many the full impact of fraud is misunderstood and underestimated. At the heart of this challenge is the tendency to lump different types of fraud together into one big problem, and then look for a single solution that addresses it. It’s as if we’re trying to figure out how to un-bake a terrible cake instead of thinking about the ingredients and the process needed to put them together in the first place. This is the first of a series of articles in which we’ll look at some of the key ingredients that create different types of fraud, including first party, third party, synthetic identity, and account takeover. We’ll talk about why they’re unique and why we need to approach each one differently. At the end of the series, we’ll get a result that’s easier to digest. I had second thoughts about the cake metaphor, but in truth it really works. Creating a good fraud risk management process is a lot like baking. We need to know the ingredients and some tried-and-true methods to get the best result. With that foundation in place, we can look for ways to improve the outcome every time. Let’s start with a look at the best known type of fraud, third party. What is third-party fraud? Third-party fraud – generally known as identity theft – occurs when a malicious actor uses another person’s identifying information to open new accounts without the knowledge of the individual whose information is being used. When you consider first-party vs third-party fraud, or synthetic identity fraud, third-party stands out because it involves an identifiable victim that’s willing to collaborate in the investigation and resolution, for the simple reason that they don’t want to be responsible for the obligation made under their name. Third-party fraud is often the only type of activity that’s classified as fraud by financial institutions. The presence of an identifiable victim creates a high level of certainty that fraud has indeed occurred. That certainty enables financial institutions to properly categorize the losses. Since there is a victim associated with it, third party fraud tends to have a shorter lifespan than other types. When victims become aware of what’s happening, they generally take steps to protect themselves and intervene where they know their identity has been potentially misused. As a result, the timeline for third-party fraud is shorter, with fraudsters acting quickly to maximize the funds they’re able to amass before busting out. How does third-party fraud impact me? As the digital transformation continues, more and more personally identifiable information (PII) is available on the dark web due to data breaches and phishing scams. Given that consumer spending is expected to increase1, we anticipate that the amount of PII readily available to criminals will only continue to grow. All of this will lead to identity theft and increase the risk of third-party fraud. More than $43 billion in total losses was reported due to identity theft and fraud in the U.S. in 2022.2 Solving the third-party fraud problem We’ve examined one part of the fraud problem, and it is a complex one. With Experian as your partner, solving for it isn’t. Continuing my cake metaphor, by following the right steps and including the right ingredients, businesses can detect and prevent fraud. Third-party fraud detection and prevention involves two distinct steps. Analytics: Driven by extensive data that captures the ways in which people present their identity—plus artificial intelligence and machine learning—good analytics can detect inconsistencies, and patterns of usage that are out of character for the person, or similar to past instances of known fraud. Verification: The advantage of dealing with third-party fraud is the availability of a victim that will confirm when fraud is happening. The verification step refers to the process of making contact with the identity owner to obtain that confirmation and may involve identity resolution. It does require some thought and discipline to make sure that the contact information used leads to the identity owner—and not to the fraudster. In a series of articles, we’ll be exploring first-party fraud, synthetic identity fraud, and account takeover fraud and how a layered fraud management solution can help keep your business and customers safe and manage third-party fraud detection, first-party fraud, synthetic identity fraud, and account takeover fraud prevention. Let us know if you’d like to learn more about how Experian is using our identity expertise, data, and analytics to create robust fraud prevention solutions. Contact us 1 Experian Ascend Sandbox 2 2023 U.S. Identity and Fraud Report, Experian.

This article was updated on November 9, 2023. Account takeover fraud is a huge, illicit business in the United States with real costs for consumers and the organizations that serve them. In fact, experts predict that by the end of 2023, account takeover losses will be over $635 billion. With consumers' data, your reputation, and your organization's financial picture on the line, now's the time to learn about account takeover fraud and how to prevent it.  What is account takeover fraud?  Account takeover fraud is a form of identity theft where bad actors gain unlawful access to a user's online accounts in order to commit financial crimes. This often involves the use of bots.  information that enables account access can be compromised in a variety of ways. It might be purchased and sold on the dark web, captured through spyware or malware or even given “voluntarily" by those falling for a phishing scam.  Account takeover fraud can do far more potential damage than previous forms of fraud because once criminals gain access to a user's online account, they can use those credentials to breach others of that user's accounts.  Common activities and tools associated with account takeover fraud include: Phishing: Phishing fraud relies on human error by impersonating legitimate businesses, usually in an email. For example, a scammer might send a phishing email disguising themselves as a user's bank and asking them to click on a link that will take them to a fraudulent site. If the user is fooled and clicks the link, it can give the hackers access to the account.  Credential stuffing/cracking: Fraudsters buy compromised data on the dark web and use bots to run automated scripts to try and access accounts. This strategy, called credential stuffing, can be very effective because many people reuse insecure passwords on multiple accounts, so numerous accounts might be breached when a bot has a hit. Credential cracking takes a less nuanced approach by simply trying different passwords on an account until one works.  Malware: Most people are aware of computer viruses and malware but they may not know that certain types of malware can track your keystrokes. If a user inadvertently downloads a “key logger", everything they type, including their passwords, is visible to hackers.  Trojans: As the name suggests, a trojan works by hiding inside a legitimate application. Often used with mobile banking apps, a trojan can overlay the app and capture credentials, intercept funds and redirect financial assets.  Cross-account takeover: One evolving type of fraud concern is cross-account takeover. This is where hackers take over a user's financial account alongside another account such as their mobile phone or email. With this kind of access, fraudsters can steal funds more easily and anti-fraud solutions are less able to identify them.  Intermediary new-account fraud: This type of fraud involves using a user's credentials to open new accounts in their name with the aim of draining their bank accounts.  This is only an overview of some of the most prevalent types of account takeover fraud. The rise of digital technologies, smartphones, and e-commerce has opened the door to thieves who can exploit the weaknesses in digital security for their own aims. The situation has only worsened with the rapid influx of new and inexperienced online users driven by the COVID-19 pandemic.  Why should you be concerned, now?  Now that digital commerce and smartphone use are the norm, information used to access accounts  is a security risk. If a hacker can get access to this information, they may be able to log in to multiple accounts.. The risk is no longer centralized; with every new technology, there's a new avenue to exploit.   To exacerbate the situation, the significant shift to online, particularly online banking, spurred by the COVID-19 pandemic, appears to have amplified account takeover fraud attempts. In 2019, prior to the pandemic, 1.5 billion records — or approximately five records per American — were exposed in data breaches. This can potentially increase as the number of digital banking users in the United States is expected to reach almost 217 million by 2025. Aite research reported that 64 percent of financial institutions were seeing higher rates of account takeover fraud than before COVID. Unfortunately, this trend shows no sign of slowing down. The increase in first-time online users propelled by COVID has amplified the critical security issues caused by a shift from transaction fraud to identity-centric account access. Organizations, especially those in the financial and big technology sectors, have every reason to be alarmed.  The impact of account takeover fraud on organizations  Account takeover can be costly, damage your reputation and require significant investments to identify and correct.  Protection of assets  When we think of the risks to organizations of account takeover fraud, the financial impact is usually the first hazard to come to mind. It's a significant worry: According to Experian's 2023 U.S. Identity and Fraud report, account takeover fraud was among the top most encountered fraud events reported by U.S. businesses. And even worse, the average net fraud loss per case for debit accounts has been steadily increasing since early 2021. The costs to businesses of these fraudulent activities aren't just from stolen funds. Those who offer credit products might have to cover the costs of disputing chargebacks, card processing fees or providing refunds. Plus, in the case of a data breach, there may be hefty fines levied against your organization for not properly safeguarding consumer information. Add to these the costs associated with the time of your PR department, sales and marketing teams, finance department and customer service units.  In short, the financial impact of account takeover fraud can permeate your entire organization and take significant time to recoup and repair.  Protection of information  Consumers rightfully expect organizations to have a solid cybersecurity plan and to protect their information but they also want ease and convenience. In many cases, it's the consumers themselves who engage in risky online behavior — reusing the same password on multiple sites or even using the same password on all sites. These lax security practices open users up to the possibility of multiple account takeovers. Making things worse for organizations, security strategies can annoy or frustrate consumers. If security measures are too strict, they risk alienating consumers or even generating false positives, where the security measure flags a legitimate user.  Organizations are in the difficult position of having to balance effective security measures with a comfortable user experience. Reputation  When there's a data breach, it does significant damage to your organization's reputation by demonstrating weaknesses in your security. Fraudulent account take-overs can affect the consumers who rely on you significantly and if you lose their trust, they're likely to sever their relationship with you. Large-scale data breaches can sully your organization's reputation with the general public, making consumers less likely to consider your services. How to build an account takeover fraud prevention strategy  There are numerous ways to build an account takeover fraud prevention strategy, but to work for your and individual consumers, it must pair robust risk management with a low friction user experience.  Here are some of the key elements to an account takeover fraud prevention strategy that hits the right notes.  Monitor interactions The risk of account takeover is constant so your monitoring should be as well. A layered, proactive and passive fraud prevention program can monitor your interactions, reduce false positives and keep track of consumers' digital identities. Use the right tools When it comes to fraud prevention, you've got plenty of choices but you'll want to make sure you use the tools that protect you, as well as consumer data, while always providing a positive experience. We use risk-based identity and device authentication and targeted step-up authentication to keep things running smoothly and only pull in staff for deeper investigations where necessary. Automate to reduce manual processes  Your organization's fraud prevention strategy likely includes manual processes, tasks that are completed by employees—but humans make mistakes that can be costly. Taking the wrong action, or even no action at all, can result in a security breach. Automated tasks like threat filtering and software and hardware updates can reduce the risk to your organization while improving response time and freeing up your team.  Choose a nimble platform  Technology changes quickly and so does fraud. You'll need access to a layered platform that lets you move as quickly as the bad actors do.  The bottom line  You can effectively mitigate against the risk of account takeover fraud and offer consumers a seamless experience. Learn more about account takeover fraud prevention and fraud management solutions.  Fraud management solutions

For companies that regularly engage in financial transactions, having a customer identification program (CIP) is mandatory to comply with the regulations around identity verification requirements across the customer lifecycle. In this blog post, we will delve into the essentials of a customer identification program, what it entails, and why it is important for businesses to implement one. What is a Customer Identification Program (CIP)? A CIP is a set of procedures implemented by financial institutions to verify the identity of their customers. The purpose of a CIP is to be a part of a financial institution’s fraud management solutions, with similar goals as to detect and prevent fraud like money laundering, identity theft, and other fraudulent activities. The program enables financial institutions to assess the risk level associated with a particular customer and determine whether their business dealings are legitimate. An effective CIP program should check the following boxes: Confidently verify customer identities Seamless authentication Understand and anticipate customer activities Where does Know Your Customer (KYC) fit in? KYC policies must include a robust CIP across the customer lifecycle from initial onboarding through portfolio management. KYC solutions encompass the financial institution’s customer identification program, customer due diligence and ongoing monitoring. What are the requirements for a CIP? Customer identification program requirements vary depending on the type of financial institution, the type of account opened, and other factors. However, the essential components of a CIP include verifying the customer's identity using government-issued identification, obtaining and verifying the customer's address, and checking the customer against a list of known criminals, terrorists, or suspicious individuals. These measures  help detect and prevent financial crimes. Why is a CIP important for businesses? CIP helps businesses mitigate risk by ensuring they have accurate and up-to-date information about their customers. This also helps financial institutions comply with laws and regulations that require them to monitor financial transactions for any suspicious activities. By having a robust CIP in place, businesses can establish trust and rapport with their customers. According to Experian’s 2023 U.S. Identity and Fraud Report, more than 85% of consumers expect businesses to respond to their identity and fraud concerns, and these expectations have risen over the past several years. Having an effective CIP in place is part of financial institutions showing their consumers that they have their best interests top of mind. Finding the right partner It’s important to find a partner you trust when working to establish processes and procedures for verifying customer identity, address, and other relevant information. Companies can also utilize specialized software that can help streamline the CIP process and ensure that it is being carried out accurately and consistently. Experian’s proprietary and partner data sources and flexible monitoring and segmentation tools allow you to resolve CIP discrepancies and fraud risk in a single step, all while keeping pace with emerging fraud threats with effective customer identification software. Putting consumers first is paramount. The security of their identity is priority one, but financial institutions must pay equal attention to their consumers’ preferences and experiences. It is not just enough to verify customer identities. Leading financial institutions will automate customer identification to reduce manual intervention and verify with a reasonable belief that the identity is valid and eligible to use the services you provide. Seamless experiences with the right amount of friction (I.e., step-up authentication) should also be pursued to preserve the quality of the customer experience. Putting it all together As cybersecurity threats are becoming more sophisticated, it is essential for financial institutions to protect their customerinformation and level up their fraud prevention solutions. Implementing a customer identification program is an essential component in achieving that objective. A robust CIP helps organizations detect, prevent, and deter fraudulent activities while ensuring compliance with regulatory requirements. While implementing a CIP can be complex, having a solid plan and establishing clear guidelines is the best way for companies to safeguard customer information and maintain their reputation. CIPs are an integral part of financial institutions security infrastructures and must be a business priority. By ensuring that they have accurate and up-to-date data on their customers, they can mitigate risk, establish trust, and comply with regulatory requirements. A sound CIP program can help financial institutions detect and prevent financial crimes and cyber threats while ensuring that legitimate business transactions are not disrupted, therefore safeguarding their customers' information and protecting their own reputation. Learn more

As the sophistication of fraudulent schemes increases, so must the sophistication of your fraud detection analytics. This is especially important in an uncertain economic environment that breeds opportunities for fraud. It's no longer enough to rely on old techniques that worked in the past. Instead, you need to be plugged into machine learning, artificial intelligence (AI) and real-time monitoring to stay ahead of criminal attempts. Your customers have come to expect cutting-edge security, and fraud analytics is the best way to meet — and surpass — those expectations. Leveraging these analytics can help your business better understand fraud techniques, uncover hidden insights and make more strategic decisions. What is fraud analytics? Fraud analytics refers to the idea of preventing fraud through sophisticated data analysis that utilizes tools like machine learning, data mining and predictive AI.1 These services can analyze patterns and monitor for anomalies that signal fraud attempts.2 While at first glance this may sound like a lot of work, it's necessary in today's technologically savvy culture. Fraud attempts are becoming more sophisticated, and your fraud detection services must do the same to keep up. Why is fraud analytics so important? According to the Experian® 2023 US Identity and Fraud Report, fraud is a growing issue that businesses cannot ignore, especially in an environment where economic uncertainty provides a breeding ground for fraudsters. Last year alone, consumers lost $8.8 billion — an increase of 30 percent over the previous year. Understandably, nearly two-thirds of consumers are at least somewhat concerned about online security. Their worries range from authorized push payment scams (such as phishing emails) to online privacy, identity theft and stolen credit cards. Unfortunately, while 75 percent of surveyed businesses feel confident in protecting against fraud, only 45 percent understand how fraud impacts their business. There's a lot of unearned confidence out there that can leave businesses vulnerable to attack, especially with nearly 70 percent of businesses admitting an increase in fraud loss in recent years. The types of fraud that businesses most frequently encounter include: Authorized push payment fraud: Phishing emails and other schemes that persuade consumers to deposit funds into fraudulent accounts. Transactional payment fraud: When fraudulent actors steal credit card or bank account information, for example, to make unauthorized payments. Account takeover: When a fraudster gains access to an account that doesn't belong to them and changes login details to make unauthorized transactions. First-party fraud: When an account holder uses their own account to commit fraud, like misrepresenting their income to get a lower loan rate. Identity theft: Any time a person's private information is used to steal their identity. Synthetic identity theft: When someone combines real and fake personal data to create an identity that's used to commit fraud. How can fraud analytics be used to help your business? More than 85% of consumers expect businesses to respond to their security and fraud concerns. A good portion of them (67 percent) are even ready to share their personal data with trusted sources to help make that happen. This means that investing in risk and fraud analytics is not only vital for keeping your business and customer data secure, but it will score points with your consumers as well. So how can your business utilize fraud analytics? Machine learning is a great place to start. Rather than relying on outdated rules-based analytic models, machine learning can vastly increase your speed in identifying fraud attempts. This means that when a new fraudulent trend emerges, your machine learning software can pinpoint it fast and flag your security team. Machine learning also lets you automatically analyze large data sets across your entire customer portfolio, improving customer experiences and your response time. In general, the best way for your business to use fraud analytics is by utilizing a multi-layered approach, such as the robust fraud management solutions offered by Experian. Instead of a one-size-fits-all solution, Experian lets you customize a framework of physical and digital data security that matches your business needs. This framework includes a cloud-based platform, machine learning for streamlined data analytics, biometrics and other robust identity-authentication tools, real-time alerts and end-to-end integration. How Experian can help Experian's platform of fraud prevention solutions and advanced data analytics allows you to be at the forefront of fraud detection. The platform includes options such as: Account takeover prevention. Account takeovers can go unnoticed without strong fraud detection. Experian's account takeover prevention tools automatically flag and monitor unusual activities, increase efficiency and can be quickly modified to adapt to the latest technologies. Bust-out fraud prevention. Experian utilizes proactive monitoring and early detection via machine learning to prevent bust-out fraud. Access to premium credit data helps enhance detection.  Commercial entity fraud prevention. Experian's Sentinel fraud solutions blend consumer and business datasets to create predictive insights on business legitimacy and credit abuse likelihood. First-party fraud prevention. Experian's first-party fraud prevention tools review millions of transactions to detect patterns, using machine learning to monitor credit data and observations. Global data breach protection. Experian also offers data breach protection services, helping you use turnkey solutions to build a program of customer notifications and identity protection. Identity protection. Experian offers identity protection tools that deliver a consistent brand experience across touchpoints and devices. Risk-based authentication. Minimize risk with Experian's adaptive risk-based authentication tools. These tools use front- and back-end authentication to optimize cost, risk management and customer experience. Synthetic identity fraud protection. Synthetic identity fraud protection guards against the fastest-growing financial crimes. Automated detection rules evaluate behavior and isolate traits to reduce false positives. Third-party fraud prevention. Experian utilizes third-party prevention analytics to identify potential identity theft and keep your customers secure. Your business's fraud analytics system needs to increase in sophistication faster than fraudsters are fine-tuning their own approaches. Experian's robust analytics solutions utilize extensive consumer and commercial data that can be customized to your business's unique security needs. Experian can help secure your business from fraud Experian is committed to helping you optimize your fraud analytics. Find out today how our fraud management solutions can help you. Learn more 1 Pressley, J.P. "Why Banks Are Using Advanced Analytics for Faster Fraud Detection," BizTech, July 25, 2023. https://biztechmagazine.com/article/2023/07/why-banks-are-using-advanced-analytics-faster-fraud-detection 2 Coe, Martin and Melton, Olivia. "Fraud Basics," Fraud Magazine, March/April 2022. https://www.fraud-magazine.com/article.aspx?id=4295017143

This article was updated on October 31, 2023 In a series of articles, we talk about understanding the different types of fraud and how to solve for them. This article will explore first-party fraud and how it's similar to biting into a cookie you think is chocolate chip, only to find that it’s filled with raisins. The raisins in the cookie were hiding in plain sight, indistinguishable from chocolate chips without a closer look, much like first-party fraudsters. What is first-party fraud? First-party fraud refers to instances when an individual makes a promise of future repayments in exchange for goods or services without the intent to repay. The first-party fraudster might accomplish this by applying for a loan or credit card they won’t pay back or misrepresenting their financial situation to get a more favorable rate. First-party fraud sometimes presents via “mules” or consumers who are persuaded to use their own information to obtain credit or merchandise on behalf of a larger fraud ring. This type of fraud has become especially prevalent as more consumers are active online. Money mules constitute up to 0.3% of accounts at U.S. financial institutions, or an estimated $3 billion in fraudulent transfers. First-party fraud is often miscategorized as credit loss and written off as bad debt, which causes problems when businesses later try to determine how much they’ve lost to fraud versus credit risk, and then make future lending decisions. How does first-party fraud impact me? Firstly, there are often substantial losses associated with first-party fraud. An imperfect first-party fraud solution can also strain relationships with good customers and hinder growth. When lenders have to interpret actions and behavior to assess customers, there’s a lot of room for error and losses. Those same losses hinder growth when, as mentioned before, businesses anticipate credit losses that aren’t actually credit losses. This type of fraud isn’t a single-time event, and it doesn’t occur at just one point in the customer lifecycle. It occurs when good customers develop fraudulent intent, when new applicants who have positive history with other lenders have recently changed circumstances, or when seemingly good applicants have manipulated their identities to mask previous defaults. Finally, first-party fraud impacts how your organization categorizes and manages risk – and that’s something that touches every department. Solving the first-party fraud problem First-party fraud detection requires a change in how we think about the fraud problem. It starts with the ability to separate first- and third-party fraud to treat them differently. Because first-party fraud doesn’t have a victim, you can’t work with the person whose information was stolen to confirm the fraud. Instead, you’ll have to work implement a consistent monitoring system and make a determination internally when fraud is suspected. As we’ve already discussed, the fraud problem is complex. However with a partner like Experian, you can leverage the fraud risk management strategies required to perform a closer examination and the ability to differentiate between the types of fraud so you can determine the best course of action moving forward. Additionally, our robust fraud management solutions can be used for synthetic identity fraud and account takeover fraud prevention, which can help you minimize customer friction to improve and deepen your relationships while preventing fraud. Contact us if you’d like to learn more about how Experian is using our identity expertise, data, and analytics to improve identity resolution and detect and prevent all types of fraud. Contact us

In today’s fast-paced world, the telecommunications industry is not just about connecting calls or sending messages. It’s about creating seamless digital experiences, especially when onboarding new customers. However, with the rise of digital services, the industry faces an increasing challenge: the need to mitigate fraud while streamlining the onboarding process.  The digital onboarding revolution Digital onboarding has transformed the way customers join telecommunications services. No longer are people required to visit a physical store or wait for lengthy paperwork. Instead, they can sign up for mobile, internet or TV services from the comfort of their homes, often within minutes. The convenience, however, has opened new doors for fraudsters. As the onboarding process happens online, the risk of identity theft, synthetic identity fraud and other fraudulent activities has surged. So, how can telecom companies provide fritctionless experiences while keeping fraud at bay? Mitigating fraud in telecommunications onboarding Know your customer (KYC) verification: Implement robust KYC solutions to verify the identity of new customers. This may include identity document checks, facial recognition or biometric authentication. Device and location data; and velocity: Analyze the device and location data of applicants. Does the device match the customer’s claimed location? Unusual patterns could signal potential fraud.  Behavioral analysis: Monitor user behavior during the onboarding process. Frequent changes in information or suspicious browsing activity may indicate fraudulent intent.   Machine learning (ML) and artificial intelligence (AI): Leverage AI/ML algorithms to detect patterns and anomalies humans might miss. These technologies can adapt and evolve to stay ahead of fraudsters.   Document verification: Use document verification services to ensure that documents provided by customers are genuine. This can include checks for altered or forged documents. Industry data sharing–consortia: Collaborate with industry databases and share fraud-related information to help identify applicants with a history of fraudulent activity or reveal patterns. The balancing act While it’s crucial to mitigate fraud, telecommunication companies must strike a balance between security and a seamless onboarding experience. Customers demand a hassle-free process, and overly stringent security measures can deter potential subscribers. By combining advanced technology, behavioral analysis and proactive fraud prevention strategies, telecom companies can create a secure digital onboarding journey that minimizes risk without compromising user experience. In doing so, they empower customers to embrace the convenience of digital services while staying one step ahead of fraudsters in today’s interconnected world.  Learn more about Experian and the telecom industry Learn more about our fraud and identity solutions

Authorized Push Payment fraud, also known as APP fraud or APP scams, involves a fraudster persuading a victim to willingly deposit funds to their account or to the account of a complicit third party, also known as a money mule. This type of fraud often includes social engineering of the victim using fake investment schemes, impersonation scams, purchase scams or other schemes. Social engineering clouds victims' judgments and encourages them to make payments willingly to one or more money mules, with funds eventually reaching fraudsters' accounts. This type of fraud has become more attractive to criminals since the advent of real-time payment systems, which are now a reality worldwide. Fraud fueled by real-time payments Authorized push payment fraud is becoming more prevalent, and it is imperative that you know how to detect and prevent it to safeguard your organization. Real-time payment systems, such as Faster Payments in the United Kingdom (UK), PIX in Brazil, the New Payments Platform in Australia, and FedNow in the USA, make real-time payment fraud a reality.  APP fraud is notoriously difficult for banks to prevent because the victim is sending the money themselves, and steps that banks take to authenticate customers are ineffective, as the customer will pass identity checks. The victims cannot reverse a payment once they realize they have been conned, as payments made using real-time payment schemes are irrevocable. APP fraud is particularly prevalent in countries where banks have an infrastructure that facilitates fast or immediate transfers, like the UK. Learn more about the new UK legislation around APP fraud Reimbursment is vital to victims Some common types of authorized push payment fraud include attacks on individuals like romance scams, family emergency swindles, targeting property transactions, and intercepting supplier payments. To protect against APP fraud, it is important to employ layered fraud protection across all products and channels used to manage real-time payments. But that alone is not enough. Reimbursement is vital in reversing the financial distress caused by APP scams, but it cannot reverse the emotional distress these scams cause. Prevention, detection, and awareness measures must be moved up on the agenda for banks, non-traditional lenders, PSPs (Payment Service Providers), and customers alike to ensure that the customer is protected at every stage of the payment journey.  Effective alerts are a key focus area for preventing customers from falling victim to APP scams. An effective warning is one that is dynamic and tailored to the customer’s payment journey. Recent research indicates that minor changes to notifications across banking apps can have the potential to drastically reduce the number of individuals that fall victim to APP fraud. The biggest effects were achieved when a combination of risk-based and Call to Action (CTA) warnings were implemented over a period of time. A collective effort across the banking industry and beyond is crucial to protect customers and tackle the fight against APP fraud. Banks, non-traditional lenders, and PSPs can raise awareness to educate their customers on the signs and risks of APP scams, and work with industry oversight bodies to commit to voluntary standards and codes to ensure good customer outcomes. Online forums, social media platforms, and influential voices also have a role to play in raising awareness of and preventing scams. Customers can also help by being vigilant and reading and acting upon warnings and information presented to them.  Authorized push payment fraud prevention To effectively combat authorized push payment fraud, financial institutions must implement a range of measures, including:  Direct communication with consumers.  Enhanced transaction monitoring.  Effective risk mitigation and management.  Improved employee education.  Public awareness campaigns.   In response to this growing threat, banks have introduced various checks and balances, such as the Confirmation of Payee (CoP) service in the UK, which cross-references bank details with the account holder's name when processing online payments.  Banks are also leveraging sophisticated fraud prevention software stacks, incorporating machine learning and contextual data to identify and flag suspicious transactions. By utilizing AI technologies, financial institutions can process  data points faster and enhance their fraud detection capabilities, mitigating identity risk and safeguarding customer accounts. Clear communication with customers is essential in the fight against APP fraud. Higher-risk companies now include warnings in their communications, advising customers not to act on messages that request payment into new bank accounts.  Financial institutions can also offer cool-off periods before payments are sent, increase due diligence around payment destinations, and monitor accounts that regularly receive high-value payments. Additionally, financial institutions can play a crucial role in educating their customers and promoting awareness around this increasingly common type of fraud. By combining these approaches with robust fraud prevention software, the public can fight against this type of fraudulent attack.  Taking the next steps with the right partner At Experian, we offer rich data sources, advanced analytics capabilities, and the consultancy services needed to rapidly adopt data analytics solutions that mitigate fraud risks. Our solutions are used by PSPs of all types and sizes – including some of the largest banks – to identify potentially fraudulent customers and transactions, and to ensure that action is taken in real time to prevent fraudulent payments being made.  Learn more about our fraud management solutions *This article leverages/includes content created by an AI language model and is intended to provide general information.